# Claim functions don't validate if the epoch is settled

Claim functions in Amphor vault don't check if epoch is settled, allowing zero-share claims and wiping others' deposit requests via claimAndRequestDeposit.

- Payout: Contest reward
- Severity: high
- Program: Amphor
- Credited: CryptoSan
- Disclosed: 2024-03-04
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-03-amphor-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-amphor%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AsyncSynthVault.sol claim functions
**Root cause:** Claim functions do not validate that the request's epoch is settled; conversion functions return zero for current epoch, and claim clears the request balance.
**Steps:**
1. Deploy vault, mint assets to Alice, Alice deposits 500e18.
2. Owner closes vault.
3. Alice calls `requestDeposit(500e18, alice, alice, "")`.
4. Alice calls `claimDeposit(alice)` in same epoch; shares=0, request balance cleared.
5. Alternatively, Bob calls `claimAndRequestDeposit(0, alice, "")` to wipe Alice's request.
**How found:** Code review of claim functions and conversion logic; noticed missing epoch settlement check and that preview functions return zero for current epoch.
**Exploitation:** Attacker calls claimAndRequestDeposit with amount 0 for any victim, triggering _claimDeposit which clears the victim's deposit request balance while giving zero shares, causing loss of funds.
**Insight:** In vault designs with epoch-based settlement, always verify that claim operations check the epoch is settled; also audit functions that allow claiming on behalf of others for griefing vectors.